The role of internal audit in assessing and providing assurance on culture is discussed, with the report presenting insights from a survey of internal audit leaders. A significant number of senior internal audit executives have not been asked by the board or audit committee However, the report does not raise (but it should) the question of whether the audit function should the very thing that the report asks internal audit to change.

The challenge with Large Language Models is that traditional compliance approaches assume you can audit You can't audit billions of neural weights the way you'd review a checklist.

predefined rules, roles, and responsibilities that are documented, communicated, and enforced through audits Transparent and Observable : Ensuring that AI systems and their governance mechanisms are explainable and auditable Continuious Algorithmic Auditing : Conduct continuous audits of AI algorithms to assess their fairness

Not preparing for audits, not even conducting them.

probably noticed something frustrating: organizations can have excellent compliance documentation, pass audits It's the difference between having environmental procedures that get referenced during audits versus environmental activities: quarterly emissions monitoring, annual environmental training, periodic waste audits compliance status through both automated monitoring and human verification without waiting for the next audit The Bottom Line The future of compliance isn't better documentation or more audits—it's integrative compliance

Organizations declare their compliance by attestation, verified by internal audits, and confirmed by external audits. operational approach is hard to find when you believe you are already “In Compliance”, confirmed by audits

themselves trapped by a siloed, reactive, and divided practice reinforced by years of prescriptive rules and audits We’re too busy putting in controls, auditing, and working on corrective actions to be proactive.

This may be enough to pass an audit but is not enough to effectively manage the risks due to: asset,

an old model where meeting obligations (the act of compliance) is a checkbox activity reinforced by audits

The audit gets passed. call this negligence: managers handing their responsibilities off to consultants, departments, and auditors — a system that does what the obligation requires, under real conditions, whether or not anyone is auditing "The system didn't flag it" becomes the new "the auditor didn't catch it" — one more place to send accountability Today we manage the compliance function — the program, the reporting, the audit calendar.

This isn't hard to imagine when excessive audits and controls are put in place as a reaction to a serious incident or serious audit findings. This produces better results than inspecting and auditing for conformance afterwards. The lack of prescription, while a good thing, is viewed negatively because it's more difficult to audit As a consequence, auditors can no longer tell organizations what to do and neither should they.

The path of " necessary evil " is fraught with uncertainty and is driven by inspections and audits. Even with the multitude of action items that come from these audits, you cannot "react" your way to better can take the road less traveled, and be in the company of those that want more than just to pass an audit